Scribd
Upload
262 views3 pages

Execute OS Commands in ABAP

This document discusses two methods for executing operating system commands from ABAP programs: 1) Using SXPT function group which checks user authorization and is the recommended SAP method, and 2) Using the CALL SYSTEM function which does not check security restrictions. It provides examples of using each method, with one example encrypting a string using OpenSSL from ABAP.

Uploaded by

EEE
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
262 views3 pages

Execute OS Commands in ABAP

This document discusses two methods for executing operating system commands from ABAP programs: 1) Using SXPT function group which checks user authorization and is the recommended SAP method, and 2) Using the CALL SYSTEM function which does not check security restrictions. It provides examples of using each method, with one example encrypting a string using OpenSSL from ABAP.

Uploaded by

EEE
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Often you need to execute command of operating system from ABAP Program, the

purpose may be for encrypt or decrypt file and compres or decompress file, and also you
need supply user input to OS Commnands.

In ABAP you can use two method, the difference from both ways is just on the security
system. but if you are consent you can choose the method that SAP is recommended.

[Link] SXPT Function Group to execute OS


Command from ABAP Program
First you need to define command in SM69, the function module will check user
authorization before execute the command, there are three function modules available to
execute OS Command.

 SXPG_CALL_SYSTEM
this function module will execute os command on the locally.

 SXPG_COMMAND_EXECUTE
this function module will execute os command on the target host

 SXPG_COMMAND_EXECUTE_LONG 
this function module will execute os command on the target host but support longer list
of parameter.

This method is SAP recommended, because it function module also consent about
security.

1 REPORT Z_TEST_PING.
2  
3 TYPES char255 TYPE c LENGTH 255.
4 PARAMETERS: pv_count TYPE i DEFAULT 5,
5             pv_targt TYPE char255 LOWER CASE.
6 DATA lt_result TYPE TABLE OF btcxpm WITH EMPTY [Link] lv_line TYPE [Link] lv_param TYPE
7 char255.
8 INITIALIZATION.
9   CALL 'C_SAPGPARAM' ID 'NAME'  FIELD 'SAPDBHOST'
10                      ID 'VALUE' FIELD  lv_param.
11   pv_targt = lv_param. ” get the db server as default target
12 AT SELECTION-SCREEN.
13   if pv_count < 1 OR
14      pv_count > 10.
15     MESSAGE ‘Please enter a number between 1 and 10.’ TYPE ‘E’.
16   ENDIF.
  if pv_targt = ”.
17     MESSAGE 'pv_target: You need to specify a destination to ping.' TYPE 'E'.
18   ENDIF.
19 START-OF-SELECTION.
20 lv_param = |–c{ pv_count } { pv_targt }|. ” this only works on UNIX like ping this wayWrite :/ ‘now executing:
21 Z_MyPing with parameters: ‘ && lv_param.Write :/ .CALL FUNCTION ‘SXPG_CALL_SYSTEM’
22   EXPORTING
23     commandname           = 'ZPING'
24     additional_parameters = lv_param
25   TABLES
26     exec_protocol         = lt_result
27   EXCEPTIONS
28     no_permission         = 1
29     command_not_found     = 2
30     security_risk         = 3
31     OTHERS                = 4.
32   IF SY–SUBRC = 0.
33       LOOP at lt_result into lv_line.
34         Write :/ lv_line–message.
35       ENDLOOP.
36   ELSE.
37       MESSAGE 'Error, return code ' && sy–subrc TYPE 'E'.
  ENDIF.
 

[Link] CALL System function call to execute OS


Command.
You can execute OS command using CALL system function call to execute OS
Command, the cons using this method it is not consent about security and you can run
most of OS command without any restriction.

Most of SAP Basis always deactivate this function by setting system profile
rdisp/call_system to ‘0’.

For example we want to encrypt string using openssl Linux OS Program from ABAP
Program and get the result.

1   DATA: lv_cmd     TYPE char1024,


2         lt_result2 TYPE TABLE OF char1024 WITH HEADER LINE.
3  
4 REFRESH: lt_result2.
5   CLEAR: lv_signature_enc.
6   CONCATENATE 'echo -n ''' lv_signature '''' INTO lv_cmd.
7  
8   CONCATENATE 'pass:' lv_passp INTO lv_passin.
9   lv_keypath = sy-sysid. TRANSLATE lv_keypath TO LOWER CASE.
10   lv_keypath = '/home/jsdadm/JSD_ssl.key'.
11   CONCATENATE  lv_cmd '| openssl sha1 -sign' lv_keypath '-passin' lv_passin '| base64'
12     INTO lv_cmd SEPARATED BY space.
13   CALL 'SYSTEM' ID 'COMMAND' FIELD lv_cmd
14                 ID 'TAB'     FIELD lt_result2[].
15   IF sy-subrc EQ 0.
16     LOOP AT lt_result2.
17       CONCATENATE lv_signature_enc lt_result2 INTO lv_signature_enc.
18     ENDLOOP.
19   ENDIF.

Common questions

Powered by AI

The CALL System method offers more flexibility in parameter handling due to its lack of predefined restrictions, allowing developers to freely execute a wide range of commands with any parameters they choose. In contrast, the SAP-recommended method uses predefined commands and parameters that are registered in SM69, providing greater structure and control but with less freedom to improvise, focusing instead on security and reliability .

SXPG_CALL_SYSTEM is designed for executing OS commands locally with standard parameter lists, whereas SXPG_COMMAND_EXECUTE_LONG allows executing commands on a target host with support for longer parameter lists. This makes SXPG_COMMAND_EXECUTE_LONG more suitable for complex command executions that require extensive parameterization, reflecting its capacity to handle more detailed input configurations than SXPG_CALL_SYSTEM .

The system profile rdisp/call_system plays a crucial role in controlling the use of the CALL System function in ABAP. By setting this profile to '0', most SAP Basis administrators deactivate the CALL System function to prevent its use, as it allows execution of OS commands without any security restrictions, which can pose security risks .

The SAP-recommended method ensures security by utilizing function modules within the SXPT Function Group that check for user authorization before executing commands. These function modules, like SXPG_CALL_SYSTEM, also manage executions within a controlled environment to minimize security risks. This structure contrasts with using direct system calls, which bypass these checks and could expose the system to potential unauthorized command executions .

Using the CALL System function without adequate security measures poses several risks, including unauthorized command execution, exposure to vulnerabilities through unregulated access, and potential system compromise. Since the CALL System function bypasses the security checks that are inherent in the SAP-recommended method, it can lead to arbitrary OS command executions, increasing the threat of malicious activities such as data breaches or disruptive command executions that could affect system integrity .

Specifying a command in SM69 is necessary because the SXPT Function Group modules rely on predefined commands to ensure proper execution and security management. By defining the command in SM69, SAP can control which operations are permitted and verify the legitimacy of each command execution, thereby maintaining a secure and regulated environment for invoking operating system commands .

The SAP-recommended method aligns with software security best practices by ensuring that each command execution is subject to strict authorization checks and is predefined through SM69. This minimizes the risk of arbitrary command execution and unauthorized access. By leveraging function modules such as SXPG_COMMAND_EXECUTE, the method enforces security policies and controls, ensuring that only legitimate and approved commands are executed, thereby protecting the system against potential security breaches .

In ABAP, the CONCATENATE statement is used to construct a complete command string by joining several smaller strings or variables together with specified separators. This is crucial for OS command execution, as it allows the developer to dynamically build the command string with necessary inputs such as file paths, parameters, or other critical command elements, ensuring that the string format matches the requirements of the command being executed .

The two methods for executing OS commands from an ABAP program are using the SXPT Function Group and the CALL System function. The SXPT Function Group includes function modules such as SXPG_CALL_SYSTEM, SXPG_COMMAND_EXECUTE, and SXPG_COMMAND_EXECUTE_LONG, which are preferred due to their security measures, such as checking user authorization before executing commands. On the other hand, the CALL System function allows executing commands without these security constraints, which is why it is often deactivated by setting system profile rdisp/call_system to '0' .

Using table-type variables like lt_result2 for capturing command output in ABAP allows the program to handle multiline outputs effectively by storing each line of output as a separate entry in the table. This structure simplifies processing and analyzing the command results within the ABAP program, enabling further operations such as string manipulation or further computation based on the output lines .

You might also like